skills.rest
Aradotso
AradotsoOFFICIAL
Explore all skills by this author →
Website𝕏@aradotsoGitHub

security-detections-mcp

Query security detection rules across multiple formats with MITRE ATT&CK coverage analysis.

11|1|Updated May 16, 2026
Search Tags:#mcp#coverage analysis#sigma#mitre att&ck#detection engineering#splunk escu#navigator layer
One-click install
npx skills add https://github.com/Aradotso/security-skills --skill security-detections-mcp
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-detections-mcp
Source: https://github.com/Aradotso/security-skills/tree/main/skills/security-detections-mcp
Command: npx skills add https://github.com/Aradotso/security-skills --skill security-detections-mcp

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Teams struggle to quickly find relevant security detections across multiple rule formats while understanding how well their coverage maps to MITRE ATT&CK and where detection gaps exist.

Core Features & Use Cases

  • Unified cross-platform detection querying: Search and retrieve rules across Sigma, Splunk (ESCU), Elastic, KQL, Sublime, and CrowdStrike CQL formats from one MCP interface.
  • MITRE ATT&CK mapping and coverage analysis: Identify which tactics, techniques, actors, and procedures are covered (and which are missing) for use cases like ransomware readiness and actor emulation.
  • ATT&CK Navigator layer output: Generate layer JSON to visualize coverage for stakeholders and to guide engineering sprints.
  • Autonomous detection engineering workflows: Support a pipeline approach that ingests CTI, runs gap analysis, and helps draft detection improvements.

Quick Start

Ask for detection coverage by saying: "Show me Splunk detections for credential dumping and summarize the MITRE ATT&CK coverage gaps for that technique."

Frequently Asked Questions about security-detections-mcp

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I search security detections across multiple SIEM platforms like Splunk and Elastic?▼

Unified cross-platform detection querying lets you search and retrieve rules across Sigma, Splunk ESCU, Elastic, KQL, Sublime, and CrowdStrike CQL from a single MCP interface. You query all supported formats simultaneously without switching tools.

What is MITRE ATT&CK coverage gap analysis for detection engineering?▼

MITRE ATT&CK coverage gap analysis identifies which tactics, techniques, actors, and procedures are covered by your existing detection rules and which are missing. It supports ransomware readiness assessments and actor emulation planning workflows.

How do I generate an ATT&CK Navigator layer to visualize detection coverage?▼

You generate ATT&CK Navigator layer JSON output to visualize your detection coverage for stakeholders and guide engineering sprints. The exported layer file maps your rule coverage directly onto the ATT&CK framework matrix.

Do I need an MCP server to query Splunk ESCU and Sigma detection rules?▼

Yes, you need an MCP server configured with local rule paths and optional ATT&CK STIX data to operate. This server setup enables the tool operations for search, retrieval, statistics, coverage analysis, and export.

Can I analyze ransomware readiness using cross-platform detection rules?▼

You can analyze ransomware readiness by mapping your cross-platform detection rules against relevant MITRE ATT&CK techniques. The gap analysis highlights which ransomware-associated tactics and procedures lack active detections.

What's the best way to build autonomous detection engineering workflows from threat intelligence?▼

An autonomous detection engineering workflow ingests cyber threat intelligence, runs ATT&CK gap analysis on existing rules, and helps draft detection improvements. This pipeline approach automates the cycle from intelligence ingestion to content creation.

Related Skills

Explore More Software Engineering Skills→
coreymaypraycoreymaypray
1

threat-intel-analyst

Profile threat actors and produce intelligence with MITRE ATT&CK mappings.

Community
Advanced
YukiIto1999YukiIto1999

analyzing-threat-actor-ttps-with-mitre-navigator

Map threat actor TTPs to MITRE ATT&CK Navigator and generate layer JSON files.

Community
Intermediate
Muath2000Muath2000

threat-intel-engineer

Integrate, normalize, and correlate cyber threat data from STIX/TAXII feeds.

Community
Advanced
coreymaypraycoreymaypray
1

threat-detection-engineer

Author Sigma detection rules with MITRE ATT&CK mapping for SIEM deployment.

Community
Advanced